Bugfix: Mongoengine based filtering insufficient

Using only(*fields) does not guarantee that the fields are hidden in
the response. Added adhoc filtering while creatin the StreamedResponse
and during jsonify().

Added test case to ensure this does not regress.